The website of the Ülemiste shopping centre — one capture, six pages, 636 requests. The Cookiebot consent platform is in place, and Google Analytics and Adform obey it. The Meta pixel does not: it sends events from the fourth second, before any choice, and keeps going after the visitor has refused everything. There is no way to refuse on the banner's first screen, and consent cannot be withdrawn at all. The 'withdraw consent' link leads back to the same banner, whose main button is 'Yes, everything's fine', and every reopening in the capture ends with a record of full consent.
Request timeline
Declared versus actual
Transfer timings
fbevents.js and the configuration of pixel 235999197630495.
The Meta pixel's first events; they repeat on all six pages.
A chat session with a persistent visitor identifier.
logconsent: preferences, statistics, and marketing switched off.
One of the pixel's six requests after the recorded refusal.
GA4 G-ZLQEVWS163; the identifier was created before consent.
Trackpoint 2025614.
The second reopening of the banner again ended with a record of full consent.
Detected trackers
- Meta Pixel (235999197630495) — connect.facebook.net, www.facebook.com/tr (33 requests); sends events before any choice in the banner and after a recorded refusal
- Google Analytics 4 (G-ZLQEVWS163) via region1.analytics.google.com, plus stats.g.doubleclick.net and www.google.ee/ads/ga-audiences — only after consent; the identifier, however, was created before consent
- Google Tag Manager (GTM-TVHBW9W) and the legacy UA-2561837-1 tag — scripts load on every page before any choice; the legacy tag sends no data-collection requests
- Adform (track.adform.net, s2.adform.net, trackpoint 2025614) — advertising tracker; only after full consent
- Cookiebot (consent.cookiebot.com, consentcdn.cookiebot.com) — consent-management platform; the widget with a withdraw button is disabled in the settings
- Askly (chat.askly.me, sessions.chat.askly.me) — support chat; receives a persistent visitor identifier before any choice and opens a session on every page
- Google reCAPTCHA (www.google.com, www.gstatic.com), Google Fonts, AddToAny (static.addtoany.com) — load on every page before any choice
- First party and infrastructure: www.ulemiste.ee (WordPress, Zone hosting — Apache / ZoneOS)
Indicators of GDPR non-compliance
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — the Meta pixel before any choice and after refusalThe site uses the Cookiebot consent platform, and Google Analytics 4 and Adform wait for consent. The Meta pixel (235999197630495) does not. It loads at +3.5 s, and from +4.3 s it sends events to www.facebook.com/tr — on each of the six pages opened, and before any choice in the banner. At +161 s, the visitor refused all non-essential categories: Cookiebot recorded the refusal, and the cookie terms page shows the status 'Keeldu'. After that, the pixel sent six more requests, one of which was interrupted. Some of the requests to Meta coincide in time with presses of the banner's own buttons: they fire 10 ms before the decision is recorded. The site's own cookie declaration classifies Meta cookies (_fbp and others) as 'Marketing', i.e. among those that require consent. The Google Analytics identifier is also created before any choice — at +4.2 s. From the very first navigation, it is carried in page addresses via the _gl parameter, and after consent, analytics continues with exactly this identifier.
- GDPR Art. 7(3) / Art. 4(11) — refusing and withdrawing consent are harder than giving itThe banner's first layer has two buttons: 'Jah, kõik sobib' ('Yes, everything's fine') and 'Soovin täpsemalt valida' ('I want to choose in more detail'). There is no refuse button, and the heading 'Jätkamiseks luba endale mõned küpsised!' ('To continue, allow yourself some cookies!') presents consent as a condition for continuing. To refuse, one must go to the second layer and press 'Luba valik' with the toggles switched off. Withdrawal is worse still: there is no separate button. The floating Cookiebot widget, which provides such a button, is disabled in the settings (enabled: false). The cookie terms page promises that consent can be withdrawn at any time. But the link 'Muuda küpsiste eelistusi või keeldu nõusolekust' opens the same banner with the same two buttons, and the main one is again 'Jah, kõik sobib'. After full consent at +244 s, the banner was reopened twice more (+249.9 s and +298.6 s), and both times Cookiebot recorded full consent for all three categories. The capture contains no refusal after +244 s. Adform and Google Analytics fired anew after each such record. Consent is given with a single click, but in the capture it could not be withdrawn.
- GDPR Art. 13(1)(c) and Art. 13(2)(a) — legal bases and retention periods in the privacy policySection 3.3 of the policy lists four legal bases — consent, contract, legal obligation, and legitimate interest — as a single list, and links none of them to the purposes in section 3.4. For all six purposes, including marketing and customer management, the retention period is stated identically: 'in accordance with the periods specified in law'. For marketing, the law generally sets no such period. The policy says nothing about cookies, web analytics, or advertising pixels. Recipients are named by category; only Maksekeskus AS is named individually. Information about Meta, Google, and Adform exists only in the Cookiebot declaration on a separate page. The banner, meanwhile, describes statistics cookies as collecting data anonymously, although, according to that same declaration, the _ga cookie stores a unique identifier for two years.
Context
ulemiste.ee is the website of the Ülemiste shopping centre in Tallinn. The controller is Ülemiste Center OÜ (registration code 10872385, Suur-Sõjamäe 4, Tallinn). The site runs on WordPress, hosted by the Estonian provider Zone; the server header reads Apache / ZoneOS. There is no Content-Security-Policy header. The site is available in Estonian, Russian, English, and Finnish. Consent is managed by Cookiebot.
The measurement is a single capture of six page loads: the homepage in Estonian, the Russian homepage twice, and the cookie terms page three times — the page on which refusal, consent, and withdrawal were tested. In total, 636 requests to 21 hosts. Of these, 23 requests to edge.microsoft.com are the browser’s built-in translator; they have nothing to do with the site and are excluded from the review. Some pages were viewed in the browser’s machine translation into Russian, which is why the wording in screenshots 4 and 5 differs from the original.
Processing is described by two documents: the cookie terms page with the Cookiebot declaration (updated September 7, 2026) and a separate privacy policy.
Who receives data directly
Before any choice — Meta (pixel), Google (Tag Manager, reCAPTCHA, Fonts), AddToAny, Askly (chat), Cookiebot. After consent, they are joined by Google Analytics 4 with its advertising endpoints and by Adform.
Declared versus actual
The consent platform here is real. Cookiebot records decisions, Google Analytics 4 and Adform stay silent before consent, and the cookie declaration lists Meta, Google, Adform, and YouTube in detail, by category. The discrepancies are concentrated in three places: the Meta pixel, the way refusal and withdrawal work, and the privacy policy itself.
First — the Meta pixel does not obey the consent platform. The pixel’s script loads at +3.5 s, and at +4.3 s the first events go to www.facebook.com/tr. This happens on each of the six pages opened, before any choice in the banner. At +161 s, the visitor refuses everything except the necessary. Cookiebot records this, and the cookie terms page shows the status ‘Keeldu’. The pixel keeps working: six more requests go out before the next decision. Moreover, some requests to Meta fire at the same moment as presses of the banner’s own buttons — 10 ms before the decision is written to the Cookiebot log. This is how the pixel’s automatic events behave when they record clicks on a page. The declaration itself classifies Meta cookies as marketing — a category that requires consent.
Alongside this is a less visible detail. The Google Analytics identifier is created at +4.2 s, long before any decision. From the very first navigation, it travels in page addresses via the _gl parameter. When consent is finally given, analytics continues with exactly this identifier. Data collection to Google does not begin before consent, but the label under which the visitor will be counted is issued earlier.
Second — refusing is hard, withdrawing does not work. The banner’s first layer offers ‘Jah, kõik sobib’ and ‘Soovin täpsemalt valida’. There is no refuse button, and the heading ‘Jätkamiseks luba endale mõned küpsised!’ presents cookies as a condition for continuing. Refusal requires the second layer, where the toggles are off, and a press of ‘Luba valik’. Consent takes one click; refusal takes two or more.
Withdrawal is in a worse state. The cookie terms page promises that choices can be changed and consent withdrawn at any time. But the link ‘Muuda küpsiste eelistusi või keeldu nõusolekust’ withdraws nothing — it simply reopens the same banner, where the main button is once again ‘Jah, kõik sobib’. There is no separate withdraw button anywhere. In the Cookiebot settings the browser received, the floating widget with a withdraw button is explicitly disabled (enabled: false). After full consent at +244 s, the banner was reopened twice in the capture. Both times Cookiebot recorded full consent for all three categories, and Adform fired anew. The log contains no refusal record after +244 s.
Third — the privacy policy does not describe the website. It lists four legal bases as a single list, with no link to purposes. The retention period for all purposes, including marketing, is reduced to the formula ‘in accordance with the periods specified in law’. It says not a word about cookies, analytics, or advertising pixels. Everything a visitor can learn about Meta, Google, and Adform is found only in the Cookiebot declaration on a separate page. The banner, moreover, calls statistics cookies anonymous, although the declaration states right there that _ga stores a unique identifier for two years.
Separately, on functional components. The Askly chat receives a persistent visitor identifier on every page and opens a session even before the visitor has contacted the chat. Google reCAPTCHA and AddToAny load on all pages before any choice. The declaration lists Askly’s data as ‘unclassified’ and does not name reCAPTCHA or AddToAny at all. These are not recorded as separate violations, since a case can be made for the necessity of a chat and form protection. But they do not fit the picture of ’everything under the control of the consent platform’.
Consent: what is proven and what is not
Proven: the Meta pixel runs before any choice. 20 requests to www.facebook.com/tr before the first decision, the first at +4.3 s.
Proven: the Meta pixel runs after refusal. The Cookiebot log at +161 s records a refusal across all three categories. The cookie terms page shows the status ‘Keeldu’ with the same time. After that — six more requests to Meta.
Proven: there is no separate withdrawal tool. In the Cookiebot settings, the widget is disabled. The terms page has only a link that reopens the banner. All three reopenings of the banner in the capture end with a record of consent.
Proven: after full consent, refusal is never recorded. After +244 s, the Cookiebot log contains only records of full consent.
Proven: the Google Analytics identifier was created before consent. The timestamp within it is 18:55:50 UTC, i.e. +4.2 s from entry. The same identifier is present in page addresses from the second navigation onward and in GA4 requests after consent.
Not proven: the names of the Meta events. The bodies of the requests to facebook.com/tr were removed during cleaning. The coincidence with presses of the banner’s buttons is established by timing, not by content.
Not established from the file: which buttons were pressed during the reopenings. Clicks are not recorded in a HAR. According to the capture protocol, these were attempts to withdraw consent. The file records their outcome — two records of full consent.
Not verified: whether the Google identifier was written to a cookie before consent. Cookie headers were removed during cleaning. Only the time of its creation and its transmission in page addresses are established.
Boundaries of this observation
The measurement covers the homepage in two languages and the cookie terms page. The shops section, gift cards, and the mobile app were not examined. The observation records browser behavior, not server-side processing. What Meta, Google, and Adform do with the data they receive is not verified by a browser-based measurement.
Pages 4–6 were viewed in the Edge browser’s machine translation. Its requests to edge.microsoft.com are excluded from the count, and banner quotations in this review are given from the Estonian original.
The file has been published cleaned: Cookie headers, the bodies of requests to Meta, and most script bodies were removed. The Cookiebot settings (settings.json) and the consent-log parameters were preserved and can be verified directly from the file. The Google client identifier and the Cookiebot consent identifier are not reproduced in this review.
Legal assessment falls to the competent authority — the Andmekaitse Inspektsioon, which is named in section 4.6 of the policy itself.
Conclusion
The shopping centre runs a fully fledged consent platform, and most of its tags obey it. The exception is the Meta pixel. It sends events from the fourth second on every page, keeps working after a recorded refusal, and fires even on presses of the banner’s own buttons. The Google Analytics identifier is also issued to the visitor before consent and lives on after consent is given.
The choice mechanism works in one direction only. Consent is one click on the first screen. Refusal is possible only via the second layer. Withdrawal does not exist as a function: the page promises it, but the link returns to a banner whose main button is ‘Yes, everything’s fine’. The widget in which Cookiebot provides a withdraw button is disabled. Every reopening of the banner in the capture ended with a record of full consent.
Remedy: bring the Meta pixel under the consent platform, so that it neither loads nor sends events without consent to marketing and falls silent immediately after refusal; do not create the Google Analytics identifier or carry it in page addresses before consent; add a refuse button to the banner’s first layer; enable the Cookiebot widget or another persistent tool with a separate withdraw button, and point the link on the terms page to it; add a section on cookies, analytics, and advertising pixels to the privacy policy, linking each purpose to its own legal basis and a specific retention period; remove the claim of anonymity for statistics cookies from the banner.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
af5b583e1c862ac6487968bc2da1cb62c639171a98e909e177ee3fe4b718f7b2
Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — ulemiste.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта ulemiste.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) Сайт использует платформу согласия Cookiebot, и Google Analytics 4 с Adform ждут согласия. Пиксель Meta (235999197630495) — нет. Он грузится на +3,5 с, а с +4,3 с отправляет события на www.facebook.com/tr — на каждой из шести открытых страниц и ещё до какого-либо выбора в баннере. На +161 с посетитель отказался от всех необязательных категорий: Cookiebot записал отказ, и страница условий cookie показывает статус «Keeldu». После этого пиксель отправил ещё шесть обращений, одно из них прервано. Часть обращений к Meta совпадает по времени с нажатием кнопок самого баннера: они уходят за 10 мс до записи решения. Декларация cookie на самом сайте относит cookie Meta (_fbp и другие) к категории «Маркетинг», то есть к тем, что требуют согласия. Идентификатор Google Analytics тоже создаётся до выбора — на +4,2 с. С первого же перехода он передаётся в адресах страниц через параметр _gl, а после согласия аналитика продолжает работать именно с этим идентификатором. 2) На первом слое баннера две кнопки: «Jah, kõik sobib» («Да, всё подходит») и «Soovin täpsemalt valida» («Хочу выбрать подробнее»). Кнопки отказа нет, а заголовок «Jätkamiseks luba endale mõned küpsised!» («Чтобы продолжить, разреши себе немного cookie!») подаёт согласие как условие продолжения. Чтобы отказаться, нужно перейти на второй слой и нажать «Luba valik» при выключенных переключателях. С отзывом ещё хуже: отдельной кнопки нет. Плавающий виджет Cookiebot, где такая кнопка предусмотрена, выключен в настройках (enabled: false). Страница условий cookie обещает, что согласие можно отозвать в любой момент. Но ссылка «Muuda küpsiste eelistusi või keeldu nõusolekust» открывает тот же баннер с теми же двумя кнопками, и главная из них снова «Jah, kõik sobib». После полного согласия на +244 с баннер открывали ещё дважды (+249,9 с и +298,6 с), и оба раза Cookiebot записал полное согласие по всем трём категориям. Ни одного отказа после +244 с в записи нет. Adform и Google Analytics после каждой такой записи срабатывали заново. Согласие даётся одним нажатием, а отозвать его в замере не удалось. 3) Пункт 3.3 политики перечисляет четыре основания — согласие, договор, юридическую обязанность и законный интерес — одним списком и не связывает ни одно из них с целями из пункта 3.4. Для всех шести целей, включая маркетинг и управление клиентами, срок хранения указан одинаково: «согласно срокам, названным в законе». Для маркетинга такой срок законом, как правило, не установлен. О cookie, веб-аналитике и рекламных пикселях политика не говорит ничего. Получатели названы категориями, по имени — только Maksekeskus AS. Сведения о Meta, Google и Adform есть лишь в декларации Cookiebot на отдельной странице. Баннер при этом описывает статистические cookie как собирающие данные анонимно, хотя, по той же декларации, cookie _ga хранит уникальный идентификатор два года. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-ulemiste-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — ulemiste.ee
To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]
I request access to my personal data processed in connection with the website ulemiste.ee.
1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing:
1) The site uses the Cookiebot consent platform, and Google Analytics 4 and Adform wait for consent. The Meta pixel (235999197630495) does not. It loads at +3.5 s, and from +4.3 s it sends events to www.facebook.com/tr — on each of the six pages opened, and before any choice in the banner. At +161 s, the visitor refused all non-essential categories: Cookiebot recorded the refusal, and the cookie terms page shows the status 'Keeldu'. After that, the pixel sent six more requests, one of which was interrupted. Some of the requests to Meta coincide in time with presses of the banner's own buttons: they fire 10 ms before the decision is recorded. The site's own cookie declaration classifies Meta cookies (_fbp and others) as 'Marketing', i.e. among those that require consent. The Google Analytics identifier is also created before any choice — at +4.2 s. From the very first navigation, it is carried in page addresses via the _gl parameter, and after consent, analytics continues with exactly this identifier.
2) The banner's first layer has two buttons: 'Jah, kõik sobib' ('Yes, everything's fine') and 'Soovin täpsemalt valida' ('I want to choose in more detail'). There is no refuse button, and the heading 'Jätkamiseks luba endale mõned küpsised!' ('To continue, allow yourself some cookies!') presents consent as a condition for continuing. To refuse, one must go to the second layer and press 'Luba valik' with the toggles switched off. Withdrawal is worse still: there is no separate button. The floating Cookiebot widget, which provides such a button, is disabled in the settings (enabled: false). The cookie terms page promises that consent can be withdrawn at any time. But the link 'Muuda küpsiste eelistusi või keeldu nõusolekust' opens the same banner with the same two buttons, and the main one is again 'Jah, kõik sobib'. After full consent at +244 s, the banner was reopened twice more (+249.9 s and +298.6 s), and both times Cookiebot recorded full consent for all three categories. The capture contains no refusal after +244 s. Adform and Google Analytics fired anew after each such record. Consent is given with a single click, but in the capture it could not be withdrawn.
3) Section 3.3 of the policy lists four legal bases — consent, contract, legal obligation, and legitimate interest — as a single list, and links none of them to the purposes in section 3.4. For all six purposes, including marketing and customer management, the retention period is stated identically: 'in accordance with the periods specified in law'. For marketing, the law generally sets no such period. The policy says nothing about cookies, web analytics, or advertising pixels. Recipients are named by category; only Maksekeskus AS is named individually. Information about Meta, Google, and Adform exists only in the Cookiebot declaration on a separate page. The banner, meanwhile, describes statistics cookies as collecting data anonymously, although, according to that same declaration, the _ga cookie stores a unique identifier for two years.
2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-ulemiste-ee/
3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.
Sincerely,
[Your name]
[contact email]
[Country]
[Date]Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — ulemiste.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi ulemiste.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Veebilehel kasutatakse nõusolekuhaldusplatvormi Cookiebot ning Google Analytics 4 ja Adform ootavad nõusolekut. Meta piksel (235999197630495) seda ei tee. See laaditakse +3,5 s juures ja alates +4,3 s juurest saadab sündmusi aadressile www.facebook.com/tr – kõigil kuuel avatud lehel ja juba enne mis tahes valikut bänneris. +161 s juures keeldus külastaja kõigist mittevajalikest kategooriatest: Cookiebot salvestas keeldumise ning küpsiste tingimuste leht näitab olekut „Keeldu“. Pärast seda saatis piksel veel kuus päringut, millest üks katkes. Osa Meta päringutest langeb ajaliselt kokku bänneri enda nuppude vajutamisega: need saadetakse 10 ms enne otsuse salvestamist. Veebilehe enda küpsiste deklaratsioon liigitab Meta küpsised (_fbp jt) kategooriasse „Turundus“, st nõusolekut nõudvate küpsiste hulka. Ka Google Analyticsi identifikaator luuakse enne valikut – +4,2 s juures. Alates esimesest lehevahetusest edastatakse seda lehtede aadressides parameetri _gl kaudu ning pärast nõusolekut jätkab analüütika just selle identifikaatoriga. 2) Bänneri esimesel kihil on kaks nuppu: „Jah, kõik sobib“ ja „Soovin täpsemalt valida“. Keeldumisnuppu ei ole ning pealkiri „Jätkamiseks luba endale mõned küpsised!“ esitab nõusolekut jätkamise tingimusena. Keeldumiseks tuleb minna teisele kihile ja vajutada väljalülitatud lülititega nuppu „Luba valik“. Tagasivõtmisega on lood veelgi halvemad: eraldi nuppu ei ole. Cookiebot'i ujuv vidin, milles selline nupp on ette nähtud, on seadetes välja lülitatud (enabled: false). Küpsiste tingimuste leht lubab, et nõusoleku saab igal ajal tagasi võtta. Kuid link „Muuda küpsiste eelistusi või keeldu nõusolekust“ avab sama bänneri samade kahe nupuga ning põhinupp on taas „Jah, kõik sobib“. Pärast täielikku nõusolekut +244 s juures avati bänner veel kaks korda (+249,9 s ja +298,6 s) ning mõlemal korral salvestas Cookiebot täieliku nõusoleku kõigi kolme kategooria kohta. Pärast +244 s ei ole salvestises ühtegi keeldumist. Adform ja Google Analytics käivitusid pärast iga sellist salvestust uuesti. Nõusolek antakse ühe vajutusega, kuid mõõtmise käigus ei õnnestunud seda tagasi võtta. 3) Privaatsuspoliitika punkt 3.3 loetleb neli õiguslikku alust – nõusolek, leping, juriidiline kohustus ja õigustatud huvi – ühe loeteluna ega seo ühtegi neist punkti 3.4 eesmärkidega. Kõigi kuue eesmärgi, sh turunduse ja kliendihalduse puhul on säilitamistähtajaks märgitud ühtemoodi „vastavalt seaduses nimetatud tähtaegadele“. Turunduse jaoks seadus üldjuhul sellist tähtaega ei sätesta. Küpsistest, veebianalüütikast ja reklaamipikslitest privaatsuspoliitika ei räägi. Vastuvõtjad on nimetatud kategooriate kaupa, nimeliselt üksnes Maksekeskus AS. Teave Meta, Google'i ja Adformi kohta on ainult Cookiebot'i deklaratsioonis eraldi lehel. Samal ajal kirjeldab bänner statistikaküpsiseid kui anonüümselt andmeid koguvaid, kuigi sama deklaratsiooni järgi säilitab küpsis _ga unikaalset identifikaatorit kaks aastat. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-ulemiste-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — ulemiste.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом ulemiste.ee. 2. Обстоятельства Я посетил сайт ulemiste.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 27.09.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) Сайт использует платформу согласия Cookiebot, и Google Analytics 4 с Adform ждут согласия. Пиксель Meta (235999197630495) — нет. Он грузится на +3,5 с, а с +4,3 с отправляет события на www.facebook.com/tr — на каждой из шести открытых страниц и ещё до какого-либо выбора в баннере. На +161 с посетитель отказался от всех необязательных категорий: Cookiebot записал отказ, и страница условий cookie показывает статус «Keeldu». После этого пиксель отправил ещё шесть обращений, одно из них прервано. Часть обращений к Meta совпадает по времени с нажатием кнопок самого баннера: они уходят за 10 мс до записи решения. Декларация cookie на самом сайте относит cookie Meta (_fbp и другие) к категории «Маркетинг», то есть к тем, что требуют согласия. Идентификатор Google Analytics тоже создаётся до выбора — на +4,2 с. С первого же перехода он передаётся в адресах страниц через параметр _gl, а после согласия аналитика продолжает работать именно с этим идентификатором. 2) На первом слое баннера две кнопки: «Jah, kõik sobib» («Да, всё подходит») и «Soovin täpsemalt valida» («Хочу выбрать подробнее»). Кнопки отказа нет, а заголовок «Jätkamiseks luba endale mõned küpsised!» («Чтобы продолжить, разреши себе немного cookie!») подаёт согласие как условие продолжения. Чтобы отказаться, нужно перейти на второй слой и нажать «Luba valik» при выключенных переключателях. С отзывом ещё хуже: отдельной кнопки нет. Плавающий виджет Cookiebot, где такая кнопка предусмотрена, выключен в настройках (enabled: false). Страница условий cookie обещает, что согласие можно отозвать в любой момент. Но ссылка «Muuda küpsiste eelistusi või keeldu nõusolekust» открывает тот же баннер с теми же двумя кнопками, и главная из них снова «Jah, kõik sobib». После полного согласия на +244 с баннер открывали ещё дважды (+249,9 с и +298,6 с), и оба раза Cookiebot записал полное согласие по всем трём категориям. Ни одного отказа после +244 с в записи нет. Adform и Google Analytics после каждой такой записи срабатывали заново. Согласие даётся одним нажатием, а отозвать его в замере не удалось. 3) Пункт 3.3 политики перечисляет четыре основания — согласие, договор, юридическую обязанность и законный интерес — одним списком и не связывает ни одно из них с целями из пункта 3.4. Для всех шести целей, включая маркетинг и управление клиентами, срок хранения указан одинаково: «согласно срокам, названным в законе». Для маркетинга такой срок законом, как правило, не установлен. О cookie, веб-аналитике и рекламных пикселях политика не говорит ничего. Получатели названы категориями, по имени — только Maksekeskus AS. Сведения о Meta, Google и Adform есть лишь в декларации Cookiebot на отдельной странице. Баннер при этом описывает статистические cookie как собирающие данные анонимно, хотя, по той же декларации, cookie _ga хранит уникальный идентификатор два года. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-ulemiste-ee/ 3. Положения GDPR, соблюдение которых прошу проверить ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)) — пиксель Meta до выбора и после отказа; GDPR Art. 7(3) / Art. 4(11) — отказ и отзыв согласия сложнее, чем согласие; GDPR Art. 13(1)(c) и Art. 13(2)(a) — основания и сроки хранения в политике конфиденциальности 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — ulemiste.ee
1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website ulemiste.ee.
2. Circumstances
I visited the website ulemiste.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 27 September 2026 (open methodology, reproducible measurements) documents the following indications:
1) The site uses the Cookiebot consent platform, and Google Analytics 4 and Adform wait for consent. The Meta pixel (235999197630495) does not. It loads at +3.5 s, and from +4.3 s it sends events to www.facebook.com/tr — on each of the six pages opened, and before any choice in the banner. At +161 s, the visitor refused all non-essential categories: Cookiebot recorded the refusal, and the cookie terms page shows the status 'Keeldu'. After that, the pixel sent six more requests, one of which was interrupted. Some of the requests to Meta coincide in time with presses of the banner's own buttons: they fire 10 ms before the decision is recorded. The site's own cookie declaration classifies Meta cookies (_fbp and others) as 'Marketing', i.e. among those that require consent. The Google Analytics identifier is also created before any choice — at +4.2 s. From the very first navigation, it is carried in page addresses via the _gl parameter, and after consent, analytics continues with exactly this identifier.
2) The banner's first layer has two buttons: 'Jah, kõik sobib' ('Yes, everything's fine') and 'Soovin täpsemalt valida' ('I want to choose in more detail'). There is no refuse button, and the heading 'Jätkamiseks luba endale mõned küpsised!' ('To continue, allow yourself some cookies!') presents consent as a condition for continuing. To refuse, one must go to the second layer and press 'Luba valik' with the toggles switched off. Withdrawal is worse still: there is no separate button. The floating Cookiebot widget, which provides such a button, is disabled in the settings (enabled: false). The cookie terms page promises that consent can be withdrawn at any time. But the link 'Muuda küpsiste eelistusi või keeldu nõusolekust' opens the same banner with the same two buttons, and the main one is again 'Jah, kõik sobib'. After full consent at +244 s, the banner was reopened twice more (+249.9 s and +298.6 s), and both times Cookiebot recorded full consent for all three categories. The capture contains no refusal after +244 s. Adform and Google Analytics fired anew after each such record. Consent is given with a single click, but in the capture it could not be withdrawn.
3) Section 3.3 of the policy lists four legal bases — consent, contract, legal obligation, and legitimate interest — as a single list, and links none of them to the purposes in section 3.4. For all six purposes, including marketing and customer management, the retention period is stated identically: 'in accordance with the periods specified in law'. For marketing, the law generally sets no such period. The policy says nothing about cookies, web analytics, or advertising pixels. Recipients are named by category; only Maksekeskus AS is named individually. Information about Meta, Google, and Adform exists only in the Cookiebot declaration on a separate page. The banner, meanwhile, describes statistics cookies as collecting data anonymously, although, according to that same declaration, the _ga cookie stores a unique identifier for two years.
Full technical documentation is published at: https://gdpru.eu/en/audits/ee-ulemiste-ee/
3. GDPR provisions I ask you to examine
ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)) — the Meta pixel before any choice and after refusal; GDPR Art. 7(3) / Art. 4(11) — refusing and withdrawing consent are harder than giving it; GDPR Art. 13(1)(c) and Art. 13(2)(a) — legal bases and retention periods in the privacy policy
4. Request
I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR.
5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.
Sincerely,
[Your name]
[contact email]
[Country]
[Date]1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil ulemiste.ee. 2. Asjaolud Külastasin veebisaiti ulemiste.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 27.09.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Veebilehel kasutatakse nõusolekuhaldusplatvormi Cookiebot ning Google Analytics 4 ja Adform ootavad nõusolekut. Meta piksel (235999197630495) seda ei tee. See laaditakse +3,5 s juures ja alates +4,3 s juurest saadab sündmusi aadressile www.facebook.com/tr – kõigil kuuel avatud lehel ja juba enne mis tahes valikut bänneris. +161 s juures keeldus külastaja kõigist mittevajalikest kategooriatest: Cookiebot salvestas keeldumise ning küpsiste tingimuste leht näitab olekut „Keeldu“. Pärast seda saatis piksel veel kuus päringut, millest üks katkes. Osa Meta päringutest langeb ajaliselt kokku bänneri enda nuppude vajutamisega: need saadetakse 10 ms enne otsuse salvestamist. Veebilehe enda küpsiste deklaratsioon liigitab Meta küpsised (_fbp jt) kategooriasse „Turundus“, st nõusolekut nõudvate küpsiste hulka. Ka Google Analyticsi identifikaator luuakse enne valikut – +4,2 s juures. Alates esimesest lehevahetusest edastatakse seda lehtede aadressides parameetri _gl kaudu ning pärast nõusolekut jätkab analüütika just selle identifikaatoriga. 2) Bänneri esimesel kihil on kaks nuppu: „Jah, kõik sobib“ ja „Soovin täpsemalt valida“. Keeldumisnuppu ei ole ning pealkiri „Jätkamiseks luba endale mõned küpsised!“ esitab nõusolekut jätkamise tingimusena. Keeldumiseks tuleb minna teisele kihile ja vajutada väljalülitatud lülititega nuppu „Luba valik“. Tagasivõtmisega on lood veelgi halvemad: eraldi nuppu ei ole. Cookiebot'i ujuv vidin, milles selline nupp on ette nähtud, on seadetes välja lülitatud (enabled: false). Küpsiste tingimuste leht lubab, et nõusoleku saab igal ajal tagasi võtta. Kuid link „Muuda küpsiste eelistusi või keeldu nõusolekust“ avab sama bänneri samade kahe nupuga ning põhinupp on taas „Jah, kõik sobib“. Pärast täielikku nõusolekut +244 s juures avati bänner veel kaks korda (+249,9 s ja +298,6 s) ning mõlemal korral salvestas Cookiebot täieliku nõusoleku kõigi kolme kategooria kohta. Pärast +244 s ei ole salvestises ühtegi keeldumist. Adform ja Google Analytics käivitusid pärast iga sellist salvestust uuesti. Nõusolek antakse ühe vajutusega, kuid mõõtmise käigus ei õnnestunud seda tagasi võtta. 3) Privaatsuspoliitika punkt 3.3 loetleb neli õiguslikku alust – nõusolek, leping, juriidiline kohustus ja õigustatud huvi – ühe loeteluna ega seo ühtegi neist punkti 3.4 eesmärkidega. Kõigi kuue eesmärgi, sh turunduse ja kliendihalduse puhul on säilitamistähtajaks märgitud ühtemoodi „vastavalt seaduses nimetatud tähtaegadele“. Turunduse jaoks seadus üldjuhul sellist tähtaega ei sätesta. Küpsistest, veebianalüütikast ja reklaamipikslitest privaatsuspoliitika ei räägi. Vastuvõtjad on nimetatud kategooriate kaupa, nimeliselt üksnes Maksekeskus AS. Teave Meta, Google'i ja Adformi kohta on ainult Cookiebot'i deklaratsioonis eraldi lehel. Samal ajal kirjeldab bänner statistikaküpsiseid kui anonüümselt andmeid koguvaid, kuigi sama deklaratsiooni järgi säilitab küpsis _ga unikaalset identifikaatorit kaks aastat. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-ulemiste-ee/ 3. Sätted, mille järgimist palun kontrollida Eraelu puutumatust ja elektroonilist sidet käsitlev direktiiv 2002/58/EÜ art 5 lg 3 (koostoimes IKÜM art 6 lg 1 p-ga a) — Meta piksel enne valikut ja pärast keeldumist; IKÜM art 7 lg 3 / art 4 p 11 — keeldumine ja nõusoleku tagasivõtmine on keerulisemad kui nõusoleku andmine; IKÜM art 13 lg 1 p c ja art 13 lg 2 p a — õiguslikud alused ja säilitamistähtajad privaatsuspoliitikas 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]